DOCKET NO.: 51876P585 



IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re the Application of: 
SooHyung Lee, et al. 

Application No.: 
Filed: 

p or: Method for Detecting Abnormal 
Traffic at Network Level Using 
Statistical Analysis 



Art Group: 
Examiner: 



Commissioner for Patents 
P.O, Box 1450 
Alexandria, VA 22313-1450 

REQUEST FOR PRIORITY 

Sir: 

Applicant respectfully requests a convention priority for the above-captioned 
application, namely: 

APPLICATION 

COUNTRY NUMBER DATE OF FILING 

Republic of Korea 2003-8 1 833 1 8 November 2003 

A certified copy of the document is being submitted herewith. 



Respectfully submitted, 

Blakely, Sokoloff, Taylor & Zafman LLP 



Dated: 



'o3 




12400 Wilshire Boulevard, 7th Floor 
Los Angeles, CA 90025 
Telephone: (310)207-3800 



William Thomas Babbitt, Reg. No. 39,591 




This is to certify that the following application annexed hereto 
is a true copy from the records of the Korean Intellectual 
Property Office. 



m s e± s. 

Application Number 



10-2003-0081833 



m m a m m 

Date of Application 



2003^ 11 SI 18S! 
NOV 18, 2003 



m m 

Applicant(s) 




Electronics and Telecommunications Research Insi 



2003 



a 12 m 04 a 



COMMISSIONER i 




10030081833 



#^ 2003/12/13 



[fgjoi] 
[SSI 

[fi!2J3E] 
[CUBIC!] 
[SS] 

[CHBIS13H] 
[XIS@e£|AU 

[&S»] 

[£S2| 5JSH!7|] 

[^eis^eis] 
[^] 

[^3] 
[»SXH 

[£Jg°l S^SJI] 

[^] 

[»sjh 

[£g°J ^SH2|] 
[£IS2| g^SDI] 



mm 

2003.11.18 

a^i^i m^s o\sm uieo, B ^^^ah°i oi& e^si ^xi 

Method for detecting abnormal traffic in network level using 
statistical analysis 



3-1998-007763-8 
9-2000-100004-8 

&Z\M SXIS, Ah «|A|S|, g£|A|- Ht«Hfi 
2000-051975-8 

LEE.Soo Hyung 

690429-1670218 

305-345 

cH^if^Ai £\&m muomm 107-1006 

KR 

CHANG , Beom Hwan 

711213-1347912 

305-503 

en 2 if 3 ai &&otmomm 203-1 106 

KR 

KIM, Jin Oh 



20-1 



10030081833 gj*h 2003/12/13 

670104-1226221 
305-729 

[^^1 CH£!i^AI S°J§ g^UBHONI^ 109-1306 

[^3] KR 

[£92l SSS^I] NA.Jung Chan 

[^eiMBlS] 620725-1408216 

305-333 

^g=? 0\^m §^OHI 121-206 

[^3] KR 
[£9°J ^SH3|] 

[£9°1 9^S:>I] SOHN, Sung Won 

t^&Je^eis] 571225-1674514 
[?3SS] 305-390 

[^^i chess* ai m°im y\±s.o\w= 208-902 

[^31 KR 

[£92| S^S^I] PARK.Chee Hang 

[^Sis^eiS] 470112-1069516 

[?3SS] 305-755 

[^^3 ches^ai o\^m m^om^. 131-1002 

[^1 KR 

[£JAHj^] 

S HI 425 £| ^§0)1 SSI, ^ S CHI £1 

^ si a oj (oi) 

[^I^fglfi] 17 3 29,000 S! 

[:iiifasi 0 ?j os! 

0 2d OS! 
[£!Al§^S] 4 » 237,000 S 



20-2 



0030081833 HXh 2003/12/13 

WJ\\1 266,000 
i^&W- ^^S] 133,000 S! 

I^AI2! did] sis- 

SIS 



20-3 



WO&0081833 #§j ^^>: 2003/12/13 

1. ^^3$H1 71^^ 7l#^-o> 

t^^, °l-g-^ MlH^H oj^i- ne|^ ^ # 7 ) 

2. Sfl^BjuI 71 #^ 

^ ^^1 B2fl^ cflolE^ °1^ BJfl^ ol-g-sl^ s-^ ^eflsi tflolEil- ^# 

^ 3tf #31^ ^Tfl^ 2.^0] s.^ Ejflij c-flolE^ =14°^ ajiisH #*1?H1H ol^> 
Befl^l- ^l^>7l ^-313 oi-g-^v v-ilH^a. =^<*IH^ o]^- #*1 

^ A oM ^€^17171 7l^-*V ^^E^S tl-i- ^ flfe 7l^Ml*)l« 

3. sn^^si 

£ ^-7)13 °l-g-tb vilH^a ^^M3 °W BHfl^ ti^ofl 

$1°]*], MlH^a^l A *-1lH^£L ^s^b] Heflsj cfl E| # ^S}*! 

tllH^H. 3*11 HHfl^ dH^S. A\ 1 #31; 4>7l vilH^H 3*11 HHfl 

^ c-l]olE^S^-Ei cflolE^l- ^#^>fe *fl 2 #31; ^7l s.^ Hsfl^ ^1 o] Ei 

* ^ A o v ^"Efl^ ^-^1^ 51<§o] ^ Seflsj cflolEi *liH*M 

*ll 3 #31; ^ ^-71 ^•#^2f, ol^- BBfl^^l <>H# ^#*1 BHfl^ ^ eflol 

20-4 



0030081833 <£z\: 2003/12/13 

B^2] ^^>Jl ^"71 o)^ Hefl^ofl cfltb ^iL» £ME^ 



£ 3 



i" — i 



20-5 



^0( 



0030081833 #3 ^x}: 2003/12/13 

^-313 ol-g-^V MIB^H o]^- HHfl^ ^{Method for detecting 

abnormal traffic in network level using statistical analysis} 



£ 2 ^ofl rtf€- ol-g-tg. ullB^la. ^§4M3 o]a o v Egfl^ ^ 

£ 3 4= 3.^3 ,g-^-g- ol-g-tr ^^]^o) o]a o v 



210 : vilH^H 211 : vflH-£)3. Ji«> ^I^(NSS) 

212 : S^g JEnfloi 



20-6 



10030081833 2003/12/13 

<7> -§-7)13 ol^-*}- tilH^H ol# ^ ^. 7l a o V 

^ V <?1*H «H3*Kr BHfl^f #4£NH #4<jr)-7l ^th -f-Tfl*} 

vilH^a. ^<>IH4 o]^- Hsfls] a o v 7 ] « o v^^. ^^ai 71 7l ^tb 7^ 

<8> o^tiV^ O.S., MlHSlH'SHM o)# #4*Hr « 0 >^^ 

e£4 -f-Tfl*} ^£ ^"Efll- 44^ H2fl5]f2] V]ZL& S^r HSflH. ^* £^ 

<9> <^7l^ > o)^v B2fl«}°]4 vi)B^3^1 ^^g- ^ dlolE^lrol al^^o.^ 

<io> £ i o. vHH^BL^HMi nefl^ #4 «J-«H1 tfltr ^JE°14. 

<n> £ 1 ofl £.^1^ 44 ^-c] i ^ufo] vflB-^HUSP l: Internet Service Provider l)^r 4 

^2} 3.% £.^1^1(112), 4 M1B^3(ISP 2), ^7l v1lB«)a(ISP 1)4 S.^. #7l 



20-7 



20030081833 #^ 2003/12/13 

VIIH^HCISP 1)2]- v1lH^H(ISP 2)1- <$^}^ MlH^EL ^l-wK^ofls. e)-^-e-1)(iio) 

^ ^-71 ^B£)3(ISP 1)# ^B^M ^tr MlH^-la ^s] a^(nmS: Network Management 
Server Hill)!- i^tf. 

<12> ^7lAi, £ 1 -g- ^V^H ^EflS] LilH^ja^HlAi olA o V ^ o^o^l cfl ^ Ji 

^ 4>7l ^-WK 110)^1^ ^e) °l] o] <&o] t E ^-^ 

<13> o]^ t ^rS] vljH^a.^ ^ ( 110)3.^- B\ HBflrf c -fl 

<15> oje^ ^eflo^ uilH^Ei^H o}^- EEflrf ^ wj-^-er, ^*>-^ sefl?jfo| 

rfl^olji, #z\x}7} ^7fl ^^*V HHfl^M sfltg- vilB^H^l 7^>a]^ ^ 01^ 



£ A o v 7l «*}7i *tftt€ ^as, LiiH^a.^}-^ ^1H£]H ^> 



20-8 



ft 



20030081833 <Qt\: 2003/12/13 

C-flolB) tiliEsrH #*1#:3H o]^- h^|. ^isHr, ^313 oj-g-tb 31 H 

gl-g- ^ 3l^*Rr31 ZL SL^o) oluf. 



<17> Aj- 7 ] s.^ o. ^§> 7 i 3$ ^ o. o. ol ^^v vi]H^a ^3H 

3 H 0 v^oi] o}<3^, Al ^> #3 0.3. vilH^32] ^ 3lB^3. ^l^f 

e^ 4Mb) 3- ^*><3 31b£1h #31 cflo]E^ -f-W^ 31 l #31; # 

71 MlH^lH 3^3 #31 31o1e^^-b1 ^ ee])S 31o1e1# 31 2 #31 ; # 

7l H2fl^ ^ cflolEil- >g-Hfl^ ^313 3-<S<3_ ^ Sefl^ 31o]e^ £S^^3 

tiliE^ o]a o v H2fl ^ ^ ^tl^Kr 31 3 #31; ^ #7] ^r#^^, o]^- B 31^3 3 <3H# 
#71 ^#*V H31^ ^ 3W1E-H- ol-g-s}^ # 7 ] JL^ Ejfl^ c-flolE^ HS.2t-^# 3^(^3M 

B)^J1, o)^v HHfl^oiTg B2fl«13 ^3"51# #7l ^^3-^- °l A o v H 

31 5] 31 3R> S-MBi^^^r 31 4 #31» ^ 

<is> ^ t .s. ^o. t BS3H» °l^ v B31^ #3 *1^3l, 4i^3 ^1# #:3°-S 

31B313.3 zf 31B^H ^-ul^«-Ei HEfld cflo]E-l# ^*}<3 L 1]B-r-l 3. ^=$3 #*fl H3l^ 
cflojEis -g-^Kr 31 1 71^; #7) 31H^1H ^3 #31 Befl^j 31^1 E^-^Ei ^ H31^ 
313^11- 31 2 3^; #7} ^#*V B31«! ^ 313^1" ^ V 313 -f-7fl3 

^ B31^ 3W1E-1 ^5.3-^3- <3# B31^ 3^1- ^-#*>^ 31 3 3^; ^ <#7] & 

#^^3, H31^3 A J-3 B31^ ^ 3Hi3» 3 3 A o v 3 ^ 

3HE-1 HS3°^t ^^1(^313B)^, <3^ B31^3# ^31 ^^tb B31^3 ^ 

20-9 



^0030081833 #^ ^7}: 2003/12/13 

<19> ^3, 3? J± 

< 20 > JE 2 t^^l 4€- #7113 ^-a- °]-g-^ tflBfla. oj^V Hs])^ ^ 

<2i> £ 2 <>fl £A]^ a}^ ^o], c^v tilH^la S.<?> *1^(NSS: 

Network Security System) (211)^ v-flH^H ^1(^15. bH-eI )(210)# f-*fl cf^M S.^. S. 
^<y(212) 21^ uil£L^3.(ISP 2)5+ ^cf. °1 ^"71 MlH^a. #«1(210)^ MlB 

$\EL^$] S.^ £^1^1(^3) HL^ Ef vilH^H(ISP2)S.^-Ei Hefl^ 31 ^*Kr 
7]^# 

<22> <^7H, £ 2 1- t^ofl nfs. ^Tjl^ -g-A^ ol^.*V LijH^H ^^H^] 

o}^ BHflS tij-^o]] cflsfl ^JS.^, -g- i-HH^a iL<# ^1^^(211) ^-g-s)<H 

ifl^H^ 3" #wl(210)3.-*fEi ^7l^o.S cfl^E^l- vils^ 3 ^ 

^ ^#«r ^, 3# #3)^ ^3 2^^] ^ Hefl^ HS-Sp^ 

<23> O] nfl, Aj-71 VllH^a *I*11 CflolE^lA-] ip^ C-flolE^l- ^#<?Hr 

20-10 



^0 



:0030081833 #^ 2003/12/13 

, 3.7]% 7>^1 sH^^i^l nj-e} ^#^14, ^ ^-^^(destination)S. 7>^ Bsfl^ 

^ (source) ^7> ^7>*>^ 3flE}-|- w>^-o.S tb *M 

(source-destination pair)^ ^iklt 9X^. 

^ #Efl^ ^f-^aj HHfl^ ^4 «1S £^*H °l A o V B^t 71^ ^ 

<27> t= 3 o. i^tgo,] n}^ -^Tj]^ ol-g-?V MlH^-la ^^H*} ojAj- Ee)]^ 

<28> AV-g-^jiL-^ HEfl^ol ^^M" Tj-o^ A]z|£ *-0} ^ j Hefl ^ ~ 

71, ^ ^ij-sl ^el ^ -^o] ^ ^.g. ^^«>^cf . ^ cflojEi yflo]^^^ 



20-11 



^1 



20030081833 #^ ^^>: 2003/12/13 

<29> c]^L t 4.^4 x\# ^o.s. 4 ^B^H^l #4 (210)5.^ HBfl^ HH41" ^4°3 

tilH^H Befls] cflo]E^ -f-^tW301, 302). 

oo> cl* j av 7 ] ^4 ^1 Heflrf cflolE^«-Ei a> 7 ) o^*v ^ 

44 s.^ Eeflsj c-flojEil- ^#*14(303). 

<31> ol^ ( # 7 ) ^#*V BBfl^ ^ t-flojE-lS #Efl<2} SS fl^^- S.cfl^^^ 444e14 

^ H2fl4 dH&| ^^4^4 4^H ^ 7 fl Ejflrfol o}^- E^o]^j ^ H2 fl^o]^ 

# ^}-^4(304, 305). 

< 32 > 4V 7 i ^^34(305), 4# B5fl^^] o>qig ^#*V H2fl4 ^ ^}o]b\^ oi-g-44 
^-7] Jpj BEfl^ 3HE| H5.412* 7,§Ai(^i:-flolH)^Jl <^4# t|]7lt!: ^ #7l "301" 4 
^JlS. 43* ^3^(306). 43 £r 4°c^ ^ Bsfl^l; f 

313 JLS. c-11olEi«llol^sl-^ 43^-5. H4 o]<# H2fl^ 44* 4*1] 4 43 

<33> a 0 v 7 ] ^^4(305), Hsfl^ol^ ^1-71 7l *i34 ^j4.£ -f}-4 ^ofl 144 ^fl «v 

49 43^-£^ -£^4^(307), 4?1 ^-^^44 oIav Ee|^| ^4 ^Ji# S-^E^ 

^4(308). 4 nfl, ^-71 ^4^44 Bsfl^^l cflt!: ^Jif °1# ^4 ^e) a1^| ^o. 

<34> 01^1^ ^- ^-^^ ^7)^o.s. mih^h4°ii ^-^4^ s^i 34*>4 



20-12 



^0030081833 <y^>: 2003/12/13 

<35> S?V, ^§£, vilB^a #«](210)3.-»M 33 s.^ Hjfl^ c-flol^l- 

BHfl^^- ^1^- ^51 o. vilB.^^ ^n} (210)2] 7 }^x\?]±, 

^ 7l^-nfl^(^)c]^- ( 3« ; #5.2] = ^>7l n]A 3 -§-)°fl ^ ol 

<37> ol^Hl^ t^^gr ^ ^€ 51^1 £]*fl *M^^r 53c.] o>^3i 

, 7^ A}^ ^O^l ^ Lflofl^ <^ ^ ^ &%o} 



^el7>fi] 7fl<^&ol ^|-^-O.S. J±4 Cf^fV ^Bfl^ He|^f ^i^- ^ 015:^- *>i=. J: 

47} ^Cf. 



20-13 



?U2( 



20030081833 #^ 2003/12/13 



20-14 



1D20030081833 #<3 Q*}- 2003/12/13 

*7fl3 ol-g-tb ^g^H^ oj^v HEflsj «^ofl oj°H, 

#711; 

^-71 ^#*V ^ Eefl^ HH^* ^ ^-Efl<q -g-Tl]^ 2.^01 jl^ ^HeI ^ 

^H^r tiling Bsfl^ ##*Rr *H 3 #741; ^ 

A oM ^#^34, o]^ BHfl^l 0>M# ^"71 ^#*b BHfl^ dl^lEil- Ol-g-^c^ #7] 

^ Hefl^ c-flolE^ HS-Bj-^^- 3Hb) ^Jl, Hefl^H^ ^ B^£l 



2] 

A 1 %H1 S^i, 

^"71 ^ HHfl^ CllolE^, 

(destination)S. 7>^ HEfl^ ^^l (source) ^i7f ^z$a>) ^7}^ $\Q^r w>^-o. S ^ 



20-15 



10030081833 



#^ 2003/12/13 



^IM (source-destination pair)^r°fl tyty Hsfl^ ^H^"?] ^J-g- s. 

3] 

1 1h Stt *fl 2 %H1 Sl^H, 

1- 3 SL^Rf- 3§-7\}q &^^r ol-g-^v LilH^3. o]a o v Ee))3j ^ aj-^. 

4] 

tilH^la. e^ c-floiEis. -f^m XI 1 71^; 

71^; 

A oM ^#*V HHfl^ ^ Hi O] E) 1- ^$\S>) -f-Tll^ £^0] JL^ HHflSj dlolEi H S 

#7j ^^34, o)<# JEEfl^o] ol-ujig ^^j. Hefl ^ ^ 01 ol Ei 1- ol-g-^o^ # 

4 ^JE* ^*>J1 ^-71 ^^421- ol^V HSfl^^l Cfltb S.U)E^S>^ *]] 4 7l^ 

20-16 



520030081833 #3 <£x\: 2003/12/13 



20-17 



20030081833 



^ 2003/12/13 




20-18 



0030081833 #^ 2003/12/13 



[51 2] 




20-19 



0030081833 
[S 3] 



ifl^a^m Hifl^ sIMb] ^ 



-301 



•302 



—303 



#7l ^# 




—304 



-305 



-306 



#71 Jtf 5«M <M 3* 



HM* Hsfl^fil £3 -307 



#7l ^144 «1# ^iS aq^^ -308 



^ 2003/12/13 



20-20 



